CVE-2026-45761: Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached during rule parsing/loading rather than by network traffic alone. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, preprocess rules to check that frames are all lowercase and/or only load trusted rulesets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 7.0.16 - Upgrade
Upgrade
Suricatato a version that resolves this vulnerability.Fixed in 8.0.5 - Compensating control
As a workaround, preprocess Suricata rules to check that frames are all lowercase and/or only load trusted rulesets, since mixed-case frame syntax during rule parsing/loading can trigger the heap buffer overflow.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments that load crafted or untrusted Suricata rules are exposed. The vulnerable path is signature parsing during rule loading, not inspection of network traffic by itself.
What does an attacker need to exploit it?
An attacker needs the ability to cause Suricata to load a crafted rule containing mixed-case frame syntax. The supplied severity vector indicates local access and low privileges are required, with no user interaction.
Are standard rule loads affected?
The issue specifically requires a crafted rule using mixed-case frame syntax. The available information does not state that default rulesets contain such rules.
What can be done before upgrading?
Preprocess rules to verify that all frame syntax is lowercase, and only load trusted rulesets. Upgrade to Suricata 7.0.16 or 8.0.5, which include the fix.
How can I determine whether a deployment is affected?
Check the Suricata version and the rules being loaded. Versions prior to 7.0.16 and 8.0.5 are affected if they load a crafted rule with mixed-case frame syntax.